tamar

Welp, looks like the dev doesn’t care about fixing this. I’m deleting it.

• This reply was modified 2 months, 1 week ago by tamar.

WordPress TI WooCommerce Wishlist plugin vulnerability. Immediate update is highly recommended. Versions: <= 2.8.2. Type: SQL Injection. More details: the vulnerability allows an attacker to execute arbitrary SQL queries in the database. https://www.ads-software.com/plugins/ti-woocommerce-wishlist/ , https://patchstack.com/database/vulnerability/ti-woocommerce-wishlist/wordpress-ti-woocommerce-wishlist-plugin-2-8-2-sql-injection-vulnerability . Update the plugin to the latest version: https://www.ads-software.com/plugins/ti-woocommerce-wishlist/ . File: wp-content/plugins/ti-woocommerce-wishlist/readme.txt.

More details. When are you releasing a fix?

k, it shows a score – I will have to keep an eye on this for additional spam though. Would still be curious on where I set the wpcf7_recaptcha_threshold if need be.

I now have Flamingo installed right now and I am only capturing email/name for a list building exercise with the subject literally being [_site_title] New Lead – so how exactly do I go about changing [your-subject] which is appearing in Flamingo > Inbound Messages > Subject since I don’t need/use it? The customer isn’t defining the subject nor am I. Shouldn’t “[_site_title] New Lead” be the approrpriate subject?

And what’s the difference between the address book (which doesn’t have any new inbound messages, just the names of the users I have on the site which I can get to via Users on the sidebar) and the Inbound Messages tab? Is the idea to put the Inbound Messages emails in the Address Book? That’s not happening right now.

Sorry for all the questions!

Actually, I do see I can do this via wpcf7_recaptcha_threshold. Where is this filter hook located? Would it be in my child theme?

I’ll also add Flamingo to this since something feels off. Only thing is, I’m not sure where I’d find these submission values since don’t they just get sent to my inbox?

• This reply was modified 11 months ago by tamar.

Yup, got my answer, thanks!

Evidently this is a known bug specifically related to PHP 8.3. I downgraded to 8.2 and it works.

https://github.com/woocommerce/woocommerce/pull/41205

Gonna hope they fix it soon.

This is the associated code on line 271 (in bold)

                        if ( ! empty( $shipping_taxes['total'] ) ) {
                                $shipping_line['total_tax'] = wc_format_decimal( array_sum( $shipping_taxes['total'] ), $dp );

                                foreach ( $shipping_taxes['total'] as $tax_rate_id => $tax ) {
                                        $shipping_line['taxes'][] = array(
                                                'id'       => $tax_rate_id,
                                                'total'    => $tax,
                                        );
                                }

Kind of lost here. I’m looking at my taxes and they’re the same as they’ve always been. This code seems to have existed from WooCommerce 7.x and up.

And yes, I rolled back to WP 2.x, kept incrementally increasing to 3, 4, 5, 6, all of which threw fatal errors till 7.x.

Right, this is leaving four of us seasoned sysadmins stumped. I have no idea what we could possibly do to even find out what the issue is.

They can be set universally on php.ini, no? That’s how they were defined and the limits were much higher.

I tried three sites with multiple themes including a vanilla install of WordPress with just the defaults.

i only did .webm once just to see if it would process. I always tried mp4.

We also checked that. All wp-content/uploads/2023/12 were already 755 (drwxr-xr-x). Could’ve tried 777 but images were being uploaded, just not large files.

I am my hosting provider. I used the plugin and all it did was disregard my email and force the email to come from the server domain. So instead of it coming from [email protected], it came from [email protected]. I think this is a WP issue anyway… I guess I’ll disable plugins one at a time and see what happens.

Thanks, much appreciated. With the eleventy billion plugins I have installed, I hate installing other plugins. But I guess it has to be done…

Actually the solution that resolves the problem comes from Astra who replied to me with the following:
To solve this, you should enable the New Header Builder under Astra > Dashboard > Settings > enable the New Header/Footer builder:?https://d.pr/i/S2XxuA

I can confirm it works.

It’s so odd, because a .sql dump of the file only shows the email address being right here:

(297,'woocommerce_email_from_address','[email protected]','no')

So I’m not sure what a WordPress expert might be able to find that I can’t. Given the frequency of emails (2-3 a week), I can’t actually disable plugins or swap themes around to test things out. It’s a store. ??

Not sure if I just need to suck it up or something. Frustrating though.